CDN场景下配置Vaultwarden启用fail2ban

# 是否允许注册  
SIGNUPS_ALLOWED=false 

# 是否开启web UI
WEB_VAULT_ENABLED=true

WEBSOCKET_ENABLED=true
LOG_FILE=/log/vaultwarden.log
LOG_LEVEL=warn
EXTENDED_LOGGING=true

# 禁止显示密码提示
SHOW_PASSWORD_HINT=false

# 启用移动端推送
# https://github.com/dani-garcia/vaultwarden/wiki/Enabling-Mobile-Client-push-notification
# PUSH_ENABLED=true
# PUSH_INSTALLATION_ID=xxx
# PUSH_INSTALLATION_KEY=xxx

[INCLUDES]
before = common.conf

[Definition]
failregex = ^.*?Username or password is incorrect\. Try again\. IP: <ADDR>\. Username:.*$
ignoreregex =

[INCLUDES]
before = common.conf

[Definition]
failregex = ^.*Invalid admin token\. IP: <ADDR>.*$
ignoreregex =

[Definition]
# 配置Nginx的conf路径
srv_cfg_path = /usr/local/nginx/conf/

# cmd-line arguments to supply to test/reload nginx:
#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf
srv_cmd = nginx

# first test configuration is correct, hereafter send reload signal:
blck_lst_reload = %(srv_cmd)s -qt; if [ $? -eq 0 ]; then
                    %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;
                  fi;

# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file="/path/file.map"]`:
blck_lst_file = %(srv_cfg_path)s/vaultwarden_blocked_ips.map

# Action definition:

actionstart_on_demand = false
actionstart = touch '%(blck_lst_file)s'

actionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s

actionstop = %(actionflush)s

actioncheck =

_echo_blck_row = printf '\%%s 1;\n' "<fid>"

actionban = %(_echo_blck_row)s >> '%(blck_lst_file)s'; %(blck_lst_reload)s

actionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^$id$/d" %(blck_lst_file)s; %(blck_lst_reload)s

[vaultwarden]
enabled = true
filter = vaultwarden
banaction = vaultwarden
logpath = /var/log/vaultwarden/vaultwarden.log
maxretry = 3
bantime = 14400
findtime = 14400

[vaultwarden-admin]
enabled = true
filter = vaultwarden-admin
banaction = vaultwarden
logpath = /var/log/vaultwarden/vaultwarden.log
maxretry = 3
bantime = 14400
findtime = 14400

http {
  ....

  # 定义一个fail2ban的日志格式
  log_format f2b_log '[$time_local] fail2ban "$blck_lst_ses" - $remote_addr - "$http_referer" - $http_user_agent" "$request"';


  # 使用RealIP模块 从CDN的X-Forwarded-For获取用户真实IP 配置为 $remote_addr
  set_real_ip_from 0.0.0.0/0;
  real_ip_header X-Forwarded-For;
  real_ip_recursive on;


  ###### Vaultwarden ######
  upstream vaultwarden-default {
    zone vaultwarden-default 64k;
    server 127.0.0.1:8080;
    keepalive 2;
  }

  # 兼容websocket
  map $http_upgrade $connection_upgrade {
      default upgrade;
      ''     "";
  }

  # 使用用户真实IP作为key
  map  $remote_addr $blck_lst_ses {
      include vaultwarden_blocked_ips.map;
  }

  server {
      listen 443 ssl http2;
      server_name www.iots.vip; # 改成你自己的域名
      # ... 省略ssl相关配置

      # 定义access log
      access_log logs/access.log;

      location / {
          # 定义403页面
          error_page 403 = @f2b-banned;
          proxy_pass http://vaultwarden-default;

          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

          # 配置websocket相关
          proxy_http_version 1.1;
          proxy_set_header Upgrade $http_upgrade;
          proxy_set_header Connection $connection_upgrade;

          proxy_redirect default;

          # 使Vaulwarden能够正确获得用户真实IP
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto $scheme;

          # 禁止爬虫相关日志
          if  ($http_user_agent ~*  "bot|spider" ) {
              access_log off;
          }

          # 判断是否被BAN  如果是则直接返回403
          if ( $blck_lst_ses != "" ) {
            return 403;
          }
      }
      location @f2b-banned {
        # 定义fail2ban日志
        access_log logs/f2b-auth-errors.log f2b_log;

        # 直接内联一个简单的403页面，并且显示用户IP
        default_type text/html;
        return 403 "<br/><center>
          <b style=\"color:red; font-size:18pt; border:1pt solid black; padding:2pt;\">
          You are banned! </b><div>Your IP address: $remote_addr</div></center>";
      }
  }
}